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1.0 Introduction 



The solution descibed is referred to as the Location Reporting & Tracking Platform, or 
LRTP. The facility to provide Location Interrogation of GSM mobile phones has already 
been successfully proven and utilized for some time. For the solution to be truly effective, 
sustaining and to provide a quality of service at critical times will require CLIENT to 
provide, or otherwise formally arrange, access to certain data and the ability to implement 
suitable hardware, software and services with 1 (one) local GSM operator. This proposal 
describes the primary components and services that are required to enable the solution. 

It is also important to note that the platform alone is not the sole element to deliver the 
quality results that are expected. It should be clear from earlier presentations and 
supporting introductory documents that this solution is not a “black-box" solution where 
the equipment alone needs to be procured or utilised. The platform will require the formal 
and legal access to enable the interrogation of each of the local GSM Service Providers. It 
is assumed that CLIENT has the authority and mandate to request such permanent 
access from both the primary Host Operator, in which the special equipment is installed 
or connected to, plus the other GSM Operators' relevant corporate entities. In addition to 
the formal access, the complete and correct raw cell data is required to be available to 
which it shall be supplemented by additional information, standardized into a common 
format, and maintained by suitably qualified and experienced telecommunication 
engineers. Periodically, as the GSM networks continue to expand, it is imperative that the 
LRTP database is continuously updated and managed. 

The document describes therefore not just the hardware & software and implementation 
service, but also the recommended on-going services that will be required to ensure the 
system delivers both the return on investment and the quality of service expected. 
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TECHNICAL DESCRIPTION 



2.0 Scope of the Location Reporting & Tracking Platform 



The Location Reporting & Tracking Platform (LRTP) to be implemented is that covering the 
GSM networks in the area required. The purpose of this platform is to provide CLIENT 
with a facility to locate and report the vicinity location of a GSM device (i.e. mobile phone). 

The LRTP facility shall enable suitably authorized users to designate "targets", to make 
queries as to the location of, and have the result reported both in text and overlaid on a 
digital map. 

The following sections summarize in short the functionality and capabilities of the 
complete LRTP platform. In the thereafter following Commercial section, IrstWAP 
proposes the basic system and platform configuration to CLIENT. 



3.0 Overview of Location Reporting & Tracking Platform 



The platform can be defined as having two distinct primary sub-systems being: 

Location Unit 

This component comprises the platform's hardware and supporting software that enables 
the interface to the Signaling System No. 7(SS7). 

Location Suite 

This component comprises the application software & the management tools. 

The scope and capabilities of the proposed platform are summarized briefly as follows: 



A) Location Unit (LU) : 

o The basic Location Unit includes: 

■ Up to 4 x SS7 Signaling links (Time Slots) per unit 

■ Up to 20 location queries per second 

■ 1 0/1 00 Ethernet connectivity 

■ Software Interface to Location Suite 

■ API Interface for 3rd party applications 

■ SS7 interface for location requests and location information provisioning 
over SS7 
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■ White-list authorization feature for location queries 

■ Basic location request and location status logging 

■ Provisioning of raw location data (such as I MSI, MSC, LAC, Cell-1 D, 
Subscriber Status, Location Age) 

■ Integrated database functionality for information such as 
Longitude/Latitude, MSC-/Cell-Name etc 



B) Location Suite (LS): 

Web interface front-end for: 

Location Interface: 

• Graphical display of current location for single/multiple target(s) 

• Graphical display of historical location information 

• Report display/download for historical location information 

• Map Navigation interface engine 

• Alarm Information 

• Target Location Administration for: 

- Location Scheduling 

- Target - User visibility 

• User Account Administration 

• GSM and GPS configuration 

SMS Broadcasting Interface: (See MobileBroadcast below) 

• SMS Broadcasting Interface 

• Broadcasting Scheduler 

• Destination Phone Book 

• Destination Import From File 

• SMS Delivery Status Reporting 

• SMS Reply reporting 

On-Demand Location Requests 

• SMS MO Engine for Location Requests from the field 

• White/Black listing of querying mobile phones 

• Mapping from Cell ID to textual location 



Location Engine 

• Location Scheduling Engine 

• Location Routing Engine 

• Location Result and Alarms processing Engine 

• Location GPS interface 

• Location GSM interface 

SMS Broadcasting Engine 

• SMS Scheduling Engine 
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• SMS Routing Engine 

• SMS Delivery Status and Reply Engine 

• Spoofing capability (create your own "Sender" ID) 

Database: 

■ Administrator Data 

■ User Data 

■ Service Data 

■ Operations Data 

■ Map Data 

General 

■ Multiple source Logging and DB storing of information and commands 

■ System configuration, monitoring and maintenance capability 

■ Backup and Archiving capability 



• Network Features: 

o Technical setup for SS7 and iSMSC access. (SS7 links and IP connectivity as 
defined in "Connectivity with local GSM Service Provider" below). 



• Support Services 

o Technical Support 

o Email and Instant Messenger-based User Help 
o 24 hours Operations Hotline Support 



(Remainder of page intentionally left blank) 
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Schematic showing relationship between key system components and users 
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Schematic of the physical networked Equipment 




Schematic of the logical network setup 
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3.1 Location / Cell Data 



The location data required by the LRTP includes LAC and Cell ID, sector and longitude 
and latitude data. This data is partially available from the GSM Service providers, such 
as the LAC and Cell ID, but will require supplementary addition of the global co- 
ordinates and readable names of locations. 

This comprehensive data is used by the platform to overlay location identification and 
animated tracking of time-based reports. The quality of the data is imperative to the 
successful operation of the platform and requires periodic maintenance as new 
BTS/Cell network infrastructure is progressively added and upgraded by GSM 
providers. This means that CLIENT has to make arrangements with the GSM Network 
providers in order to get updates as soon as the network planning concerning Cells 
has changed. 

In order to provide the full service functionality to delivery the desired output, 
IrstWAP requires the following minimum set of data for each GSM Cell. IrstWAP 
action is to process, improve and implement these data sets in the LRTP: 



Component 


Sample 


LAC 


1000 


CELLJD 


10111 


Type 


Sector 


Cell Diameter [m] 


212 


Cell Centre [m] 


106 


Azimuth 


0 


Site Identifier 


Wien 




16 


Longitude 


25 


15.59 




E 




48 


Latitude 


11 


9.27 




N 


Altitude 




LONG_SHAPE 


1 6,42086 


LAT_SHAPE 


48,18773 


Textual Name 


<Text Description of the Cell 


Comment 


<Additional Data> 



All coordinates have to be provided in WGS84 long/lat format without projection and 
rotation. 
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3.2 Single MSISDN Location Check (FastTrax) 



FastTrax is the name used by 1 rstWAP to describe the single entry location query of a 
particular mobile phone or GSM SIM card enabled device. The FastTrax module is a 
simple to use, single entry facility that allows the operator to enter a single MSISDN 
and enact a single location check. These requests can be initiated directly from the 
FastTrax web-based application, from a registered (qualified) mobile phone (see 
FastTrax-MO below) or from the LRTP server console. 




Locate 



Schedule 



History 



[M| Entry 

Q HP Number : +[ 

Q Alias : 

% Query Method : O ATI ® PSI 




(Entry Section) 



• The “target" mobile MSISDN (hand phone number) is entered in the relevant field. 

• Options exist for the selection of the query type; ATI (Any Time Interrogation) or 
PSI (Provide Subscriber Information). ATI is the default setting. PSI involves 
“forcing" a paging (via type zero SMS) to the hand phone which will result in an 
update of the HLR. 

• The result of the query will provide the detailed screen such as that shown on the 
next page 



(Remainder of page intentionally left blank) 
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(Target Interrogation Result Page) 

• The “target" MSISDN is described in 3 data sets; 

> ENTRY - This shows the entry data used to make the query and the result 
category. (Target Interrogation Successful is the best result). Alternate 
information is returned that can include suggestions to the user to try a PSI 
query, if ATI does not delivery the complete results. The information will assist 
the user understand the result quality of the query. 

> Location Address Data - “Target located in the vicinity of....". This includes the 
name defined in the database of the geographical location to which 
BTS/Cell(center) the target is currently (or previously attached). The result 
denotes the TIME of the result and the PHONE STATUS, both of which 
provide positive indications to the current or historic status. Phone status can 
be IDLE (turned on and not used), IN USE (turned on and being used) or 
ABSENT (The phone is not logged onto any network, as per the data in the 
HLR). 

> Map Links - Currently two map links are provided to enable a user with 
internet access to link the query. These are provided with the standard 
implementation but with very simple customisation, links to the CLIENT'S own 
mapping application can be achieved. Such map application could be Mapinfo. 
The current Google links provide a positive proof of concept. See example on 
the next page: 



(Remainder of page intentionally left blank) 



CONFIDENTIAL - Subject to change without prior notice! 



11 








elaman 



oiivMtm «F«;yfliTv voiutfoni 



e 'o 




(Google Earth© Interface) 



> Longitude and Latitude are provided in the result and is the source for mapping 
interface. The values are digital co-ordinates. 

> Telco Data includes the Home Network of the target, the Roaming (or currently 
active) Network, the MSC global title obtained from the query and the MSC 
global title name obtained from the LRTP database, the Cell Reference which 
provides a unique identifier which is mapped to the Cell Data in the LRTP 
database and provides the co-ordinate and address values, Azimuth and Radius 
Sector radius will be used when operator provides this cell information to 
CLIENT. 



(Remainder of page intentionally left blank) 
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3.2.1 FastTrax Scheduler 



Selecting the Tab "Schedule" for the Scheduling functions, operators have the option to 
set the start and end date, the interval of location checkings, the days or the hours. 




HP Number : +| 


! Alias : 1 


! Query Method : O ATI O PSI 





i Start Date 



-P 



r End Date 



JO Repeat every... [ 



minute(s) 



Between the hour(s) of 
Only on these day(s) 



Schedule 



| hh:mm and | | hh:mm 

□ Sun □ Mon □ Tue □ Wed 



□ Thu 



□ Fri 



□ Sat 







@ Select HP Number to upen/ Edit/ Remove 



(FastTrax Scheduler) 



4.2.2 FastTrax History Function 

The FastTrax "History" Tab provides an easy way to find previous location queries. The 
ten last interrogated mobile numbers are listed already in the "Locate" Tab. However, the 
detailed search possibility of the History function allows to find particular previous 
interrogations based on criteria such as date, MISIDN or alias name. 




(History Page) 
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Locate Schedule History 



Q History.. 



© HP Number 
© Start Date 



©Alias 
© End Date 



| Location || Detail(s) | 



Pagejs|:2 of 9 1|2|3|4|5|6|7|8|9| 



No HP Number Alias 


Location Address 


Query Date Time 


Entrie(s) 


Latitude. Longitude 


11 491 72451 7 xxx 


1. GERMANY 


2007-09-09 21:10 


B 1 




12 491724608xxx 


1. GERMANY 


2007-09-17 01:02 


B 7 






2. GERMANY 


2007-09-17 01:02 


B 7 


50.93.6.8491 




3. Adalbertstr. 35-10179 GERMANY 


2007-09-13 00:20 


111 4 


52.5079.13.4239 




4. Beethovenstr. 30. A1. A4-50858 GERMANY 


2007-09-10 20:38 


11 1 


50.93.6.8491 




5. Berlin Mitte Adalbertstr. 35 10179 Germany 


2007-08-29 13:00 


B i 


52.5079.13.4239 




6 Moenchengladbach Rheydt Scharmannstr. 1. 
' Odenkirchener Str. 41236 Germany 


2007-08-29 10:53 


B i 


51.1609.6.4459 




7. INDONESIA 


2007-08-20 17:38 


11 1 




13 491724695xxx 


. Abu Dhabi International Airport Abu Dhabi-Area 
761 U.A.E. 


2007-09-09 21:30 


B 2 


24.4400,54.6240 




2. Abu Dhabi-Area 761 U.A.E. 


2007-09-09 21:28 


11 2 


24.4400.54.6240 




3. 


2007-08-22 16:14 


B 5 




14 491 72641 8 xxx 


1. Harkortstr.. Gablonzstr.^4225 GERMANY 


2007-09-12 02:15 


B 3 


51 .4758.7.4429 


15 491728002xxx 


1. GERMANY 


2007-09-10 20:07 


B 3 




16 491731806xxx 


1. 


2007-09-09 21:09 


1 




17 491734639xxx 


1 Wuppertal Langerfeld Puelsoehde 41-42389 
' GERMANY 


2007-09-05 23:19 


B i 


51.2752.7.2607 




2. Germany 


2007-09-05 15:37 


B i 




18 491762321xxx x 


1. GERMANY 


2007-09-17 01:01 


B i 






2. Hamburg AK HH-Sued A1. A255 21109 Germany 


2007-08-30 15:45 


B 2 


53.5064.10.0411 




3. HamburgAK HH-SuedAI . A25521 109Germany 


2007-08-28 15:15 


B 13 


53.5064.10.0411 




4. INDONESIA 


2007-08-20 17:36 


S i 





(Result from searching certain MSISDN) 



Locate Schedule History 



[1 History.. 

© HP Number 
© Start Date 



©Alias 
© End Date 





i 




l 





Location 



Detail(s) 



Page(s): I of 1 1 | 



No Query Date 

1. 2007-09-13 00:20 

2. 2007-09-12 02:02 

3. 2007-09-05 10:02 

4. 2007-09-04 18:35 



HP Number Alias : 491724608&xx 
Location Address : Adalbertstr. 35-10179 GERMANY 
Latitude, Longitude : 52.5079 ,13.4239 

3 

3 



Phone Status 

3 

3 



(The details of the search result) 



CONFIDENTIAL - Subject to change without prior notice! 



14 



daman 

MHi4H IICUmTV (01 




4.2.3 FastTrax-MO Feature 

FastTrax-MO is the name used by IrstWAP to describe the ability of a registered (white- 
listed, duly authorized) user to request the single entry location query of a particular 
MSISDN from his/her mobile GSM device . The system receives and logs the requests 
initiated directly from the FastTrax application (via Internet/Intranet) and the FastTrax-MO 
(via SMS) from a registered (qualified) mobile in the same way. The reports of all queries 
are available in the FastTrax MO Admin application. The creation and configuration of a 
new user for either FastTrax or FastTrax-MO is through the FastTrax MO Admin 
application. 




(Example of received location information on a mobile device) 
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4.2.4 FastTrax MO Admin Application 



The FastTrax MO Admin application provides a web-based interface to administrate 
platform users and user authorizations, incl. white listing of mobile GSM devices for 
MO location queries, i.e. location tracking of targets via the mobile device of CLIENT'S 
operators/field personnel. Furthermore, it allows to blacklist certain MSIDNS so that 
these blacklisted MSIDNS cannot be tracked/located by the users of the systems (e.g. 
to protect the privacy of certain individuals). Another important monitoring and 
supervision feature is the Location Request History, with which an Administrator can 
monitor the location checking activities of his operators. 




; : Thu 15-11-2007 14:29:34 User: test Logout 



| User Administration || Blacklist Administration^] Location Records"] | Admin | 

Location Request History 

0 User [ v] 0 Type | All v [ Download | 

0 From 1 15 v|l1 v|2007 v| 0 To 1 15 v|l1 v|2007 v| [ Display | 



Date/Time 


Target 


User 


Location Result 


Details 


2007-11-15 

14:23:00 


6285691053710 


FT_test 


Jakarta -MJK14(3G) Jl. Kapt. Tendean 24, ''Radiant ~Kec. 
Mampang Prapatan, Kel. Pela Mampang ~ Jakarta - 
12720~INDONESIA 


more 


2007-11-15 

14:22:00 


628179717471 


FT_test 


+62818445615 INDONESIA 


more 


2007-11-15 

14:22:00 


6281510068101 


FT_test 


Jakarta -MJK04 INDONESIA 


more 


2007-11-15 

14:21:00 


4237918499 


FT_test 


+919814797098 INDIA 


more 


2007-11-15 

14:20:00 


628179811155 


FT_test 


Jakarta INDONESIA 


more 


2007-11-15 

13:35:00 


628568575854 


FT_test 


Jakarta -MJK04 INDONESIA 


more 


2007-11-15 

13:34:00 


628551128551 


FT_test 


7T> 


more 


2007-11-15 

13:33:00 


628568575854 


FT_test 


Jakarta -MJK04 INDONESIA 


more 


2007-11-15 

13:33:00 


447767771521 


FT_vincent 


+447785012400 UNITED KINGDOM 


more 


2007-11-15 

11:56:00 


62818868800 


FT_test 


Abu Dhabi UAE 


more 


2007-11-15 

11:42:00 


628568575854 


FT_test 


Jakarta -MJK04 INDONESIA 


more 



1 2 3 4 5 6 7 89 10 11 12 13 



(Location Request Page) 
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Location Request Detail 



Parameter 


Value 


Target : 


628562156794 


Date / Time : 


2007-00-13 17:33:11 


Requesting Handphone : 


FT_s im u_adm in_ftx 


Password : 


SMS Request Text : 


Location Request Authorization Status : 


Authorized 


IP Address : 


Request Virtual Number : 


Country : 


Indonesia 


Operator : 


Indosat-IDNSL 


MSC Name : 


Bandung -MBD03 


Cell ID : 


510.1.10250.13305 


Destination HP State : 


Hand Phone turned on 


Age of Location : 


1 


Latitude : 


-6.1815 


Longitude : 


106.9081 


Cell Radius : 


-1 


Cell Radius Start Angle : 


190 


Cell Radius End Angle : 


0 


Cell Gravity : 


unsupported 


Cell Text Description : 


JAKARTA-TIMUR INDONESIA 


API Message ID f Error Code : 


GSM Location Type : 


Type Zero 


Location SMS Text : 


Lot: at bn SMS Result Delivery Status : 



Cancel j 



(Location Request Detail Page) 



4.3 Multiple Targets and Periodic Location Checks (FTrax) 



Unlike FastTrax (single number, current location), the FTrax application allows for 
a complete management of multiple targets (GSM and GPS based) and ability to 
perform and report user-defined, automated periodic location checks. This allows 
the operator to define a target and define the time interval that the system will 
automatically perform a location check. Each check will be logged in a report 
available to be viewed on screen or downloaded for later data mining, archiving, 
integration with other data, resorting, etc. Further advanced system features such 
as vicinity alert (2 targets are in close proximity to each other) are currently in 
development. 

The Reports generated and all user Location Requests are also logged in the 
system audit logs which provide a means of applying controls on system usage 
and system generated reports. 

The basic process is as follows: 
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• The “target" must be registered in the system as a “traceable entity" object. 

• The object is marked as “Locate" and the current location data is retrieved from 
the GSM network either; (1) One-off, meaning current location or (2) marked for 
tracking for set length of time where periodic queries run for a defined period. 

• The system receives and processes the data. This variable information is merged 
with fixed infrastructure locations. 

• The web application displays the “target", respectively its GSM Cell (or GPS) 
location on suitable digital maps, (see Fig 1) Besides the “graphical" display, the 
option to view textual detail also exists. The operator can drill-down to lower level 
maps as far as available and whenever appropriate, (see Fig 2) 

• The authorized officer will manage the target and the information distribution. 

• The maps and supporting detailed information, including history through animation, 
can be viewed via encrypted IP connection. 

• Updates can be further distributed to (authorized) staff via SMS, which can display 
the textual data. This can be updated at periodic intervals as defined. 



Naturally the process described can be expanded to various permutations based on 
requirements. The basic concept is that a TARGET, respectively its GSM Cell location 
is defined and overlayed as spatial data on a digital map plus available in text detail. 
The database can maintain historic records of periodic updates and replay these as 
required and also to provide detailed audit logs. Update locations can be automatically 
dispatched externally from the platform, as required, to limited (authorized) 
distribution list by various media, primarily as SMS. Equally, an incoming SMS query 
from a “white-listed" hand-phone can also trigger a target interrogation, plus 
response, supported by activity audit trail. 



4.4 Mapping 



The platform has a method to implement various map formats, with digital maps 
being the most ideal although not mandatory. The database contains various maps (as 
needed by the user) to overlay the target location. Maps can be “photo" type such as 
Google Earth, other satellite or aerial images; they may be “street-directory" style 
displaying street names and other landmarks. The platform is capable to utilise any 
map, which acts as the under-lay to provide graphical identification suitable to the 
user. CLIENT must provide maps with at least 2 GPS reference points for further 
processing and implementation in the platform. 




O rurjaSm* 

ffi' r awlesfe 



Pilihan Penjejakan 

O Tampil Semua 
® Tampil Tertentu 



| Peta ] | Detail ] 



® Lokasi saat ini 



O 1 hari 
O 2 hari 
O 1 minggu 
O 2 minggu 



Histori Kendaraan 




Fig. 1 



Fig. 2 
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Depending on the zoom level maps with different scales are displayed. During system 
planning it has to be agreed which and how many different scales and maps shall be 
used ( See also Pricing Notes in the Commercial section ). Maps have to be provided 
by CLIENT prior to LRTP installation. Optional a map administration tool with map 
administration training can be provided. 

For each level of map: 

• All Maps in level must have longitude and latitude coordinates annotated 
clearly around the edges of the maps (minimum longitude and latitude for top 
left and bottom right positions. These coordinates will be used in the 
calibration of the system) 

• Either 1 file containing a map with the whole of that level OR 

• Multiple files containing map parts for a level 

• Map format should be in jpeg format (or similar format that can be converted 
into jpeg format using Photoshop©, freehand or similar product) 

• If map is not in jpeg format, or a format which can be imported into 
Photoshop, the name of the system used to create the map should be 
provided, and if possible an installable copy of the software (plus license 
details) should be included with the map delivery 




Maps can be delivered to IrstWAP electronically - email, FTP, CDRom, Flash Drive - 
or by courier. 

The supply of maps is the responsibility of CLIENT. IrstWAP shall undertake the 
calibration and installment into the LRTP based on the offering. 

4.5 LRTP Suite Special Features 



4.5.1 SMS Broadcast ( MobileBroadcast) 

The platform has the capability to be enabled (as an option) as a carrier-grade 
SMSC. This will naturally be dependant on CLIENT'S agreement with Host 
Operator allowing such capability, but the platform can enable the CLIENT to send 
high volume and priority SMS to its permitted community. This powerful tool will 
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enable CLIENT'S organisation to send SMS to a large number of people extremely 
quickly. (System configured with 4 x El Timeslots, with each link capable of up to 
10 sms/sec, resulting in up to 2,400 SMS per min or up to 144,000 SMS sending 
per hour). We call this facility MobileBroadcast. 

What is MobileBroadcast: 

This facility provides a 2-way inter-active SMS messaging facility that utilizes SMS as the 
means of communication. It is, in short, a carrier-grade SMS - Send and Receive facility. 

The primary benefits to CLIENT of this module is that it requires very little training, is very 
simple and intuitive to use. This powerful communication tool with high throughput 
performance empowers CLIENT to reach 10's of thousands of people in a matter of 
minutes. 

Primary Features; 

• Send a single message (SMS) to a single number or broadcast a message to 
thousands of people 

• You have options of manually entering the destination number(s), selecting from your 
stored numbers in the application's Phone Book or importing a list of numbers from 
an offline database, (csv file import) 

• You have options of sender identification; either a name, e.g. " CLIENT-ABC ", or a 
long "virtual" number to which people can reply or send to. 

• All replies or messages sent to your "Virtual Number Range" can be viewed from the 
web application, they can be received in massively high volume with no congestion, 
no "memory full", always available, (see "What are Virtual Numbers" below) 

• Virtual Number replies can be subsequently downloaded for further sorting or 
reprocessing. 

• Provides detailed Delivery reports for all messages sent so you can identify clearly if 
your message was received or not (and specifically, why not!) 

• You can send messages "immediately" or schedule them for a specific time in the 
future. 

• Your messages can be "personalized" with recipients name in the same batched 
broadcast. 

What are Virtual Numbers and how do they benefit CLIENT? 

The LRTP iSMSC will be configured with a Global Title (GT) and National 
Pointcode (NPC). Additionally, it is suggested that CLIENT requests the Host 
Operator to allocate a number block (assigned to virtual HLR in the IrstWAP 
Messaging Node). This will take the form of a number range to which the LRTP 
can utilize as Virtual Numbers. The system can SEND messages from these 
numbers and replies or SMS-MO can be RECEIVED and processed by the 
system. The iSMSC is therefore a "supper sender and receiver" of SMS. Virtual 
Numbers can be used by the CLIENT for several purposes but primarily as 
MSISDN that are terminated in the system rather than into a SIM card. SMS 
received to Virtual Numbers can be configured such that they can be; 

• Redirected into the MobileBroadcast application and become "machine 
terminated" and read through the application and later stored; 

• Automatically replied to with some custom applications (not included in 
standard LRTP offering) such that senders can be provided with SMS 
feedback. Presume this to be similar to "fax-back" services except where 
SMS is the communication medium. 

• Allocated to various application that can be created for CLIENT (not included 
in standard LRTP offering) such as "hiding" the sender but allowing bi- 
directional messaging. 
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• Provides anonymous sender capability most suitable CLIENT staff, who do 
not want to give up a personal number but hide their identity. Staff of the 
CLIENT could be allocated a “Virtual Number", which is mapped to his active 
number. This virtual number can remain static whilst the active number could 
be interchangeable. All SMS received could be redirect to the staff. The 
facility could allow CLIENT staff to also send SMS from his active phone and 
it will appear to come from his virtual number on the receivers phone. 



4.5.2 SMS Spoofing - Pretend to be Someone Else 

The platform has the capability to "spoof" a sender ID on SMS. This means that 
CLIENT will have the ability to "pretend" to be another party. Such SMS sender 
spoofing techniques have been already successfully used to trap, mislead, or to 
confuse targets. As a tool in anti terrorism, the LRTP can enable CLIENT to send 
SMS to target to whom it seeks to manipulate their communication by assuming 
the identity of another to whom they may trust. An example of this might be to 
send a message to one or more targets using the actual phone number of another 
in their group. This information may be to fool the recipient to go somewhere or 
do some action to which allows CLIENT to capture, identify, extract information 
from targets or similar. In summary, it provides the capability of impersonating 
another person through SMS. 



4.6 Connectivity with Local GSM Service Providers 



The platform requires a SS7 connection with at least one GSM Service Provider that 
has inter-working relationship with other relevant GSM Service Providers in the area 
to be covered. The platform requires the interrogation of the target entity's HLR, VRL 
& MSC. The platform requires constant availability to make such interrogation. 

The platform interrogates the GSM Network provider(s) network infrastructure based 
on standard GSM (ESTI) implementations of HLR, VLR and MSC. If a GSM Network 
provider has non-standard GSM (ETSI) implementations of the above mentioned 
network components installed in his network, CLIENT has to provide the respective 
information to IrstWAP prior to system installation and IrstWAP will investigate 
whether and how such a non-standard implementation can be accommodated. 
Dependent on the required effort, such a specific development can be subject to 
additional costs ( See also Pricing Notes in the Commercial section) . 

It is assumed that CLIENT has the authority and mandate to request such permanent 
access from the primary Host Operator, to which the special equipment is 
connected, and the rights to interrogate the other GSM Operators' mobile devices. 

The LRTP will be located in a secure environment within the CLIENT'S Site Location. 
CLIENT need to ensure that IrstWAP can install and as far as required and agreed 
remotely maintain the LRTP. All the GSM Service Providers also need to include the 
global title (GT) of the platform's iSMSC into their SMSC white-list to permit legal and 
controlled HLR interrogations. (ITU standards - IR.21 document) 

See also Pricing Notes in the Commercial section : CLIENT remains responsible for 
any charges imposed from any of the GSM Operators in connection with SS7 and IP 
connectivity, cell data provisioning and SMS traffic consumed by CLIENT. The 
assumption is that CLIENT has an existing agreement with operator(s) for the 
purpose of GSM interrogation. The iSMSC is therefore provisioned under contract 
between the Host Operator and CLIENT and hence, IrstWAP is the nominated 
"Operational Service Facility" on behalf of CLIENT. 
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Schematic showing relationship between SS7 system components 




4.7 Access to Location Data outside Client's Country 



The LRTP will enable CLIENT to interrogate the SS7 network location information of 
any MSISDN of the Host Operator or ANY operator with whom the Host Operator 
has an SMS interworking agreement with (basically, any network where a subscriber 
of the Host Operator can send an SMS) and that has not blocked the Host Operator 
in regard to PSI and/or ATI interrogations. As such, a location query could be effected 
on a MSISDN of a target outside the home country of CLIENT and Host Operator. It 
can be assumed that a result could provide a specific MSC but not the “physical 
location". It could be that this information is required by CLIENT and is not available 
through information supplied from the Host Operator, and CLIENT does not wish to 
make it known to the Host Operator of such query. 1 rstWAP risk mitigation can be an 
optionally procured service used to define the problem through relationship 
networking. Specifically, 1 rstWAP can apply discretion and stealth to try to obtain 
information directly from specific GSM operators that is normally NOT provided to 
3rd parties, even though it is not actually commercially or technically sensitive. Also, 
1 rstWAP have the potential to obtain the information via a query using our own 
commercial nodes and other commercial Location Based Solution (LBS) business. 
Thus, we can seek the answer from various sources which may not be available to 
CLIENT who have the limitation of a single (LRTP) node. Currently, 1 rstWAP 
maintains a MSC database of ca. 16.000 MSCs in ca. 158 countries of which ca. 
4.000 MSC locations are known to 1 rstWAP through its commercial activities. The 
MSC database entries are continuously improved and enlarged. Assumptions are 
made on the coverage area of a MSC based on usual MSC coverage ranges. 
1 rstWAP does not guarantee location information of remote area MSCs and MSCs 
still unknown to 1 rstWAP. Furthermore, IrstWAP's commercial activities enable it to 
maintain and enlarge its own Cell Data database in several countries. A list of 
countries with MSC data availability can be provided on request. 
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Such "service" can also be applied to other Telco Related Anomalies (primarily 
outside the sovereign country): 

Situations may exist where it becomes necessary for CLIENT to understand whether 
an operator outside the sovereign country has already implemented ATI, and where 
they have, whether they have implemented "white-listing" (allowing specific SMSCs) 
or "black-listing (preventing specific SMSCs) which prevent the expected result from 
being made available. IrstWAP risk mitigation can be the service to used to define 
the problem through relationship networking. Specifically, and as mentioned above, 
IrstWAP can obtain information from many GSM operators through personal / 
professional relationship links, discretion and stealth. 

In countries where number portability exists, and the desired result is not provided, 
CLIENT will may need to least contact CLIENT'S peer organization to determine 
definitive location. The primary variable will be "which operator" to contact. (IrstWAP 
risk mitigation can be the service used to define the problem through relationship 
networking. It may be possible though IrstWAP's own nodes to determine an 
answer and if required, to make requests through social channels to define the carrier 
to which the MSISDN currently belongs and subsequently define the location). 
Specifically, and as mentioned above, IrstWAP can obtain information from many 
GSM operators through personal / professional relationship links, discretion and 
stealth. 

The incidence where CLIENT is able, due to favourable circumstances, to make direct 
contact with an operator, the problem will be to determine the most direct path to 
the relevant engineering manager to contact at the relevant operator. 

1 rstWAP can provide a risk mitigation service which can be the service used to assist 
CLIENT to define mobile operator problems through relationship networking. 
Additionally, information such as location data that IrstWAP owns in its own 
database (NOT related to any other LRTP client) can be made available to CLIENT to 
supplement their database. As each client will have varying needs and capabilities, 
this sensitive issue can never be distinctly defined in this proposal and can be 
included after detailed discussions with CLIENT at the appropriate time. 
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